Missing authorization check in customer master data reading, SAP security note 1561295

SAP Note 1561295
SAP Security Note
Medium priority

SAP security note 1561295, "Missing authorization check in customer master data reading", is a program error note released on 11.10.2011. Below are the symptom, SAP recommended solution and the affected software components.

ComponentLogistics – General > Logistics Basic Data > Business Partners > Customer Master

CategoryProgram error

PriorityCorrection with medium priority

TypeSAP Security Note

Version3

StatusReleased for Customer

Released on11.10.2011

LanguageEnglish

Description

Symptom

An authenticated user can use functions of Customer master data to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the attached correction instruction.

Reason and prerequisites

Customer master data does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may lead to undesired system behavior.

References

This note refers to

888889 – Automatic checks for security notes using RSECNOTE (outdated)

Referenced by

888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

SAP_APPL 40B
SAP_APPL 45B
SAP_APPL 46B
SAP_APPL 46C
SAP_APPL 470
SAP_APPL 500
SAP_APPL 600
SAP_APPL 602
SAP_APPL 603
SAP_APPL 604
SAP_APPL 605

Full note on SAP: SAP Support Launchpad note 1561295

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Customer Master #Master Data #Authorization Check #Business Partners